EDRF 50.3.0

The Trellix EDR with Forensics (EDRF) 50.3.0 release includes new features, enhancements, and resolved issues.
Every update release is cumulative and includes all features and fixes from the previous release.

Release Details

For a complete list of supported platforms, see the Trellix Knowledge Base (KB) article, Supported Platforms for Trellix EDR with Forensics - KB000014084.

New or changed

Event Streamer module

The Event Streamer module is a telemetry component in the Streaming policy that captures endpoint activity and event telemetry to Trellix Helix, Syslog servers, and DXL brokers.

The key capabilities include:

• Windows Event Logs: Capture standard and custom Windows event logs, such as Security, System, and Windows Defender events.

• Windows file events: Monitor new activity generated directly within specific log files on Windows endpoints, including DHCP, DNS, Exchange, IIS, and Net Logon.

• OS events: Capture operational system activity from the local Eventor database across Windows, macOS, and Linux endpoints. The module buffers data locally before streaming it to external destinations. 

• Event filters: Control which endpoint events stream to external destinations using specific inclusion or exclusion criteria.

• Module settings: Control local event storage (in-memory or disk), send triggers (time-based, event-count-based, or both), maximum batch size, database capacity, and cleanup frequency to the local event store.

For more information, see Event Streamer module.

Antivirus engine and Protection Policy retired

EDRF Client version 50.3 eliminates the bundled Bitdefender Antivirus engine and standalone Protection Policy from the EDRF Client installer package.

Endpoints running EDRF extension version 50.2 or earlier retain the existing protection policy settings. 

The key updates include:

• Installer package: The EDRF Client installer no longer includes the bundled Bitdefender antivirus engine.

• ePO console UI: The ePO Policy Catalog hides the Protection Policy category and on-demand scan options.

• Policy management: Trellix ENS manages endpoint antivirus, malware protection, and script scanning policies.

For more information, see Protection policy.

Increase policy exclusion character limits in EDRF policies

The maximum character limit for all exclusion fields across EDRF policies is increased from 3,072 to 200,000 characters.

For more information, see Configure EDRF policies. 

Troubleshoot endpoint performance using Exclusion Advisor Audit

EDRF Client 50.3 introduces the Exclusion Advisor Audit diagnostic tool that analyzes the endpoint telemetry events such as excessive file write operations, process spawning, and repetitive file hashing that causes high CPU, RAM, or disk input/output (I/O) usage.

The tool generates JSON reports that highlight resource-consuming activities.

• Expanded telemetry analysis: Analyzes local endpoint event logs, kernel traces, text logs, and file operation databases, including events.db, trace.db, trace.log, and file_hash.db.

• Multi-platform support: Runs on Windows, Linux, and macOS endpoints managed by EDRF Client 50.3.0 or later.

• Multiple execution methods: Executes via local Command Line Interface (CLI) scripts, remote triggers from the Endpoint Security (HX) Web UI using Acquire Agent Diagnostics, or standard Minimum Escalation Report (MER) collections.

• Automated parsing and analysis: Integrates with the EDRF Client Diagnostics Analyzer Tool to convert raw JSON audit metrics into visual HTML reports containing pre-formatted policy exclusion suggestions.

For more information, see Troubleshoot endpoint performance using Exclusion Advisor Audit.

Automatic upgrade from Endpoint Security (HX) to EDRF

Trellix ePO - On-prem supports automatic upgrades from Endpoint Security (HX) to Trellix EDRF. This feature converts HX policy configurations, host sets, and host set associations into EDRF policies and System Tree groups without manual policy recreation.

The key capabilities include:

• Converts host sets and policy hierarchies into EDRF policies for Windows, Linux, macOS endpoints without manual recreation.

• Recreates Trellix HX host sets as System Tree subgroups in Trellix ePO - On-prem.

• Applies a priority hierarchy to resolve overlapping host set assignments and establish effective configurations.

• Generates General, Streaming, Detection, and Remediation policies automatically to prevent policy gaps.

For more information, see Automatic Upgrade from Endpoint Security (HX) to EDRF.

Manage endpoint quarantine and containment across EDRF and Endpoint Security (HX)

EDRF Client 50.3 provides a unified network isolation workflow across Windows, Linux, and macOS endpoints.

• Bidirectional status synchronization: Quarantining a device in Trellix EDR updates its status to Contained in Endpoint Security (HX). Containing a device in Endpoint Security (HX) updates its status to Quarantined in the EDRF Console. The status updates synchronize automatically between the EDRF and Endpoint Security (HX) consoles.

• Dual local unlocking: Unlocks isolated endpoints locally using either the HX Containment Unlock Code or the Remediation Policy Password configured in Trellix ePO.

• Centralized policy settings in Trellix ePO: Manages custom notification text, web page URLs, application path exclusions, and host IP allowlists centrally under Remediation Policy in Trellix ePO.

• Threat event logging: Logs containment and un-containment actions initiated from Endpoint Security (HX) as Threat Events and forwards them to Trellix ePO.

For more information, see Unified quarantine and containment in EDRF.

Linux Self-Protection for BTRFS

The Self-protection feature now supports Linux endpoints running the B-tree File System (BTRFS). OpenSUSE and SUSE Linux Enterprise Server (SLES) are new additions to the list of supported operating systems. 

For more information, see General Policy.

Edit the registered Endpoint Security (HX) server

You can modify configuration details of an existing registered Endpoint Security (HX) server instance directly within ePO without deleting and re-registering the server instance. This capability works in both ePO - On-prem and ePO - SaaS environments.

For more information, see Edit the registered HX server in ePO - On-prem.

Support for hardened Linux environments

EDRF Client now supports deployment on hardened Linux operating systems. It operates on systems where the /var partition uses the noexec mount flag to meet CIS benchmarks. 

To comply with Linux security standards, the EDRF Client isolates executable binaries from dynamic data:

• Executable binaries and plugin libraries: Stored in /opt, where system security policies permit program execution.

• Non-executable dynamic data: Stored in /var, where the system maintains variable runtime data, including local databases and log files.

Schema parity for S3 bucket trace export

EDRF Client sends trace telemetry to Amazon Web Services (AWS) and Google Cloud Platform (GCP) S3 buckets in native nested JSON format. This format maintains direct schema parity with local endpoint trace database (trace.db) files. This applies to Windows environments only.  

All environmental and system-level metadata fields (including hostname, os, and pFullName) are retained and exported across trace events without data flattening.

Resolved issues

Known issues

For a list of current known issues in this product release, see the Trellix Knowledge Base article, EDR with Forensics Known Issues - KB000014081.